apache-xml-security-c -- heap overflow during XPointer evaluation

The Apache Software Foundation reports: The attempted fix to address CVE-2013-2154 introduced the possibility of a heap overflow, possibly leading to arbitrary code execution, in the processing of malformed XPointer expressions in the XML Signature Reference processing code...

DSA-2710-1 xml-security-c - several

Bulletin has no description...

Debian: Security Advisory (DSA-2710-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-2154

CVE-2012-2154 corresponds to a cross-site scripting (XSS) vulnerability in the CDN2 Video module 6.x for Drupal. The vulnerability arises from the module not sanitizing output, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. According to the DRUPAL-SA-CON...

SA-CONTRIB-2012-050 - CDN2 Video - Unsupported

CDN2 is a plug and play module and video management service for Drupal. The module does not sanitize output correctly, allowing for a cross-site scripting XSS vulnerability. Additionally, the Form API is not correctly utilized allowing for cross-site request forgery CSRF attempts. This module...

CVE-2011-2154

CVE-2011-2154 affects SmarterTools SmarterStats 6.0 web server. The loginsettings cookie is missing the HTTPOnly flag in the Set-Cookie header, allowing potential script access to the cookie and exposure of sensitive information. The available data from NVD lists a CVSS v2 base score of 5.0 (Medi...

Debian DSA-2154-1 : exim4 - privilege escalation

A design flaw CVE-2010-4345 in exim4 allowed the local Debian-exim user to obtain root privileges by specifying an alternate configuration file using the -C option or by using the macro override facility -D option. Unfortunately, fixing this vulnerability is not possible without some changes in...

CVE-2010-2154

Cross-site scripting XSS vulnerability in the Search Site in CMScout 2.09, and possibly other versions, allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: some of these details are obtained from third party information...

CVE-2010-2154

CMScout is affected by a Cross-Site Scripting (XSS) vulnerability in the Search Site. The issue concerns the search parameter in CMScout 2.09 (and possibly other versions), where an attacker can inject arbitrary web script or HTML. The underlying cause is XSS in the search input, allowing remote ...

CVE-2010-2154

creationtimestamp| type| source ---|---|--- 2010-05-30 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/12806...

IBM Db2 Multiple Vulnerabilities - Windows

IBM Db2 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-2154

CVE-2009-2154 describes a SQL injection in Impleo Music Collection 2.0: vulnerable component is admin/login.php, trigger via username when magic_quotes_gpc is disabled. Remote attackers can execute arbitrary SQL commands. CVSS v2 base score 6.8 (MEDIUM). No remediation details are provided in the...

CVE-2009-2154

creationtimestamp| type| source ---|---|--- 2009-06-15 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8947...

CVE-2008-2154

CVE-2008-2154 affects IBM DB2 on multiple platforms: IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2. The vulnerability resides in the install_jar (sqlj.install_jar) procedure, which allows remote authenticated users to create or overwrite arbitrary files via unspecified calls. In ZDI d...

IBM Db2 Universal Database Multiple Vulnerabilities (Sep 2008) - Windows

IBM Db2 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 3 : cups (CESA-2005:571)

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Common UNIX Printing System CUPS provides a portable printing layer for UNIXR operating system...

CVE-2006-2154

EMC Retrospect for Windows is affected: versions 6.5 prior to 6.5.382, 7.0 prior to 7.0.344, and 7.5 prior to 7.5.1.105 do not drop privileges before opening files, allowing a local user to execute arbitrary code via the File>Open dialog. Root cause: failure to drop privileges prior to file ac...

CVE-2002-2154

CVE-2002-2154 describes a directory traversal vulnerability in the web server component Monkey HTTP Daemon 0.1.4. Remote attackers can read arbitrary files by using dot-dot sequences in the request path. The problem is documented across multiple feeds (NVD, Red Hat advisories, CVE listings) with ...

RHEL 3 : cups (RHSA-2005:571)

Updated CUPS packages that fix a security issue are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. The Common UNIX Printing System CUPS provides a portable printing layer for UNIXR operating system...

CVE-2005-2154

CVE-2005-2154 concerns osTicket prior to or including 1.3.1 beta, where a PHP Local File Inclusion (LFI) flaw exists in the scripts view.php and open.php . The vulnerability arises from unsafely handling the inc parameter, enabling remote attackers to include and potentially execute arbitrary loc...